From b3ce7ae006b60f23d6515cd10a63c9bf4b370fdb Mon Sep 17 00:00:00 2001 From: Ostap Zherebetskyi Date: Fri, 11 Sep 2026 15:43:22 +0300 Subject: [PATCH] Generate unique passwords for unconfirmed users and when deleting external identities --- api/users/views.py | 3 ++- framework/auth/views.py | 3 ++- website/profile/views.py | 3 +++ 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/api/users/views.py b/api/users/views.py index 9dc9f9475b3..1ace6e87813 100644 --- a/api/users/views.py +++ b/api/users/views.py @@ -1,3 +1,4 @@ +import uuid import pytz from urllib.parse import urlencode @@ -781,7 +782,7 @@ def post(self, request, *args, **kwargs): accepted_terms_of_service = timezone.now() if accepted_terms_of_service else None user = OSFUser.create_unconfirmed( username=clean_email, - password=None, + password=str(uuid.uuid4()), fullname=fullname, external_identity=external_identity, campaign=None, diff --git a/framework/auth/views.py b/framework/auth/views.py index 870eec7c204..dbb4d3eecfb 100644 --- a/framework/auth/views.py +++ b/framework/auth/views.py @@ -1,3 +1,4 @@ +import uuid from furl import furl, urljoin from rest_framework import status as http_status from urllib.parse import urlencode @@ -1128,7 +1129,7 @@ def external_login_email_post(): accepted_terms_of_service = timezone.now() if form.accepted_terms_of_service.data else None user = OSFUser.create_unconfirmed( username=clean_email, - password=None, + password=str(uuid.uuid4()), fullname=fullname, external_identity=external_identity, campaign=None, diff --git a/website/profile/views.py b/website/profile/views.py index a08a586742e..c7740f98aa7 100644 --- a/website/profile/views.py +++ b/website/profile/views.py @@ -1,3 +1,4 @@ +import uuid import logging from rest_framework import status as http_status @@ -438,6 +439,8 @@ def delete_external_identity(auth, **kwargs): auth.user.external_identity[service].pop(identity) if len(auth.user.external_identity[service]) == 0: auth.user.external_identity.pop(service) + if not auth.user.has_usable_password(): + auth.user.set_password(str(uuid.uuid4())) auth.user.save() return